List Mantis is operated by Whale and Wave Digital Ltd ("we", "us", "our"), a company registered in England and Wales (company number 17188418), registered office 66 Paul Street, London EC2A 4NA. We are the data controller for the personal data described in this policy.
For any privacy question, or to exercise your rights, contact us at hello@listmantis.com.
List Mantis is a UK-only service — we cover UK marketplace listings only — that alerts you when new public listings on third-party marketplaces match a search you have saved. This policy explains what personal data we handle — both your data as a user, and personal data that can appear inside public listings we check on your behalf — and what we do with it.
1. The personal data we collect
Account data
Your email address, your name (if you give it), and a securely hashed password. If you sign in through Apple or another provider, we receive the identifier that provider passes to us.
Search and location data
The searches you create (keywords, filters, price ceilings, conditions), and the location you set for distance filtering — you give us a UK postcode, which we convert to approximate coordinates to calculate distance. We do not track your device's live location.
Alert and usage data
A record of the alerts we have sent you and the listings they matched, plus basic technical data (app/version, device type, and privacy-friendly analytics — see section 8).
Payment data
Subscriptions are handled by Stripe and/or Apple. We do not receive or store your full card details. From Stripe we keep only a customer identifier and your subscription status; on iOS, Apple manages the transaction and shares only what is needed to confirm your subscription.
2. Listing data from third-party marketplaces
How it works. When you create a search, List Mantis checks public listings on third-party marketplaces (including Facebook Marketplace, AutoTrader, Gumtree, eBay and Vinted) and notifies you when a new listing matches. We access eBay listings through eBay's official API and MOT history through the official DVSA MOT History API. For the other marketplaces, we access only listing information that those sites make available to any visitor without logging in. We do not log in to those marketplaces, we hold no accounts with them, and we never ask for or use your marketplace accounts or passwords.
Personal data inside listings. Public listings can contain personal data about the person who posted them — for example a seller's display name, a general location, or a vehicle registration mark visible in a photo. When we process this to run your alerts, our lawful basis is legitimate interests (see section 4), and we apply strong data minimisation: matching runs in memory as listings are checked, and we retain data only for listings that actually matched one of your searches — such as the title, price, approximate location, a link to the listing's image on the marketplace, and the link to the original listing. We do not store copies of listing images (images load directly from the marketplace), we do not store listing descriptions, and we do not store sellers' names, profile photos, or contact details.
We link, we don't republish. Every alert links back to the original listing on the source marketplace. We do not resell listings or build a public archive of them, and we delete stored listing data once the listing is no longer live or your search is removed.
If you are a seller and believe we hold information taken from one of your listings, contact hello@listmantis.com and we will provide, correct, or delete it (see section 10).
3. Vehicle and MOT data
Where a car listing shows a number plate, we may read the plate from the listing image and look up the vehicle's MOT history using the official DVSA MOT History API, to show MOT status, advisories and mileage record on your alert. To read the plate from the image we use the Google Gemini API as a processor (see sections 6 and 9). MOT history describes the vehicle, not you, and contains public sector information licensed under the Open Government Licence v3.0. A vehicle registration mark can, in some circumstances, identify an individual, so we treat it as personal data and apply the same minimisation and retention rules.
4. How we use your data, and our lawful basis
| What we do | Lawful basis (UK GDPR) |
|---|---|
| Create and secure your account; sign you in | Contract (Art 6(1)(b)) |
| Run your searches, match listings, and send your alerts | Contract (Art 6(1)(b)) |
| Check public marketplace listings, including any personal data they contain, to find matches for you | Legitimate interests (Art 6(1)(f)) — providing a listings-alert service, balanced against the limited, public nature of the data and our minimisation measures |
| Look up MOT history for vehicle listings | Legitimate interests (Art 6(1)(f)) — helping you assess a vehicle advertised for sale |
| Take payment and manage your subscription | Contract (Art 6(1)(b)) |
| Keep the service secure, prevent abuse, and fix faults | Legitimate interests (Art 6(1)(f)) |
| Send you service messages (e.g. changes to your subscription) | Contract / legitimate interests |
| Send marketing emails (only if you opt in) | Consent (Art 6(1)(a)) — withdraw anytime |
| Meet legal and accounting obligations | Legal obligation (Art 6(1)(c)) |
Where we rely on legitimate interests, we have carried out a balancing assessment; you can ask us for a summary, and you can object to that processing (see section 10).
5. We do not sell your data
We do not sell your personal data, and we do not share it with advertisers or other third parties for their own marketing.
6. Who we share data with (our processors)
We use a small set of trusted service providers who process data on our instructions:
- Hetzner — hosting and infrastructure (Germany, EU).
- Stripe — payment processing and subscription management.
- Apple — App Store subscriptions and push notifications (APNs).
- SMTP2GO — sending transactional email (your alerts and account messages).
- Loops — sending marketing/onboarding email (only if you have opted in).
- Google Workspace — our business email and documents (e.g. when you contact us or make a data-rights request).
- Netlify — hosting for our marketing website.
- Google (Gemini API) — reading number plates from car-listing images (see section 9).
- DVSA — official MOT history lookups.
- Cloudflare — security and privacy-friendly, cookieless website analytics.
Some of these providers are based outside the UK (see section 7). Each is bound by a data processing agreement. We use AI-assisted development tools under terms that do not train on our data, and we do not input customer personal data into them. We keep our current list of processors under review and will update this policy when it changes.
7. International transfers
Some of our providers process data outside the UK, including in the United States (Stripe, Apple, SMTP2GO, Loops, Google, Cloudflare, Netlify). Where data leaves the UK, we rely on an approved safeguard — a UK adequacy regulation, the UK International Data Transfer Agreement, or EU Standard Contractual Clauses with the UK Addendum — so your data receives an equivalent level of protection. You can ask us which safeguard applies to a given transfer.
8. Cookies and analytics
Our website uses Cloudflare analytics, which is privacy-friendly and does not use tracking cookies or build advertising profiles. The app uses only the storage needed to keep you signed in and remember your settings. If we ever introduce non-essential cookies, we will ask for your consent first.
9. The Google Gemini plate-reading step, explained
To turn a plate visible in a listing photo into an MOT lookup, the relevant image is sent to the Google Gemini API, which returns the plate characters. We send only what is needed for that task, use it only to provide the MOT feature to you, and do not use it to build any profile of sellers. We rely on Google's data-processing terms — under which your data is not used to train Google's models — and its international-transfer safeguards for this step.
10. Your rights
Under UK data protection law you have the right to: access your data; have it corrected; have it deleted; restrict or object to processing (including processing based on legitimate interests); data portability; and to withdraw consent where we rely on it. You can delete your account and associated data from within the app, or contact hello@listmantis.com. We respond within one month.
You can also complain to the Information Commissioner's Office (ico.org.uk; 0303 123 1113), though we would appreciate the chance to resolve your concern first.
11. How long we keep data
- Account data: kept while your account is active, and for up to 90 days after closure to handle any final billing or disputes, then deleted or anonymised.
- Listing and alert data: deleted once the listing is no longer live or you remove the search; alert records are kept only briefly (around 30 days) to run the service.
- Delivery logs (email/push): kept around 30 days for deliverability and troubleshooting.
- Payment and accounting records: retained for 6 years to meet UK tax and accounting law.
12. Children
List Mantis is intended for users aged 18 and over and is not directed at children. We do not knowingly collect data from anyone under 18.
13. Changes to this policy
We may update this policy as the service develops. When we make a material change we will update the "Last updated" date and, where appropriate, tell you in the app or by email.
14. Contact
Whale and Wave Digital Ltd, 66 Paul Street, London EC2A 4NA — hello@listmantis.com.
ICO registration: ZC230981.